The Binance heist now has a name attached to it, and it's the one most of us feared: North Korea.
TRM Labs attributes the $6.36B theft to TraderTraitor, the DPRK unit US authorities already tied to the Bybit hack, and says it holds that view with "high confidence." Chainalysis and on-chain sleuth ZachXBT reached the same conclusion. ZachXBT also found Binance loot commingled at one address with funds from the earlier Bitget hack after routing through THORChain, which points to a single actor behind both.
Why this matters for $BNB and the wider market: DPRK crews are patient, professional launderers. TRM counts roughly $2.7B frozen, mostly stablecoins, while about $2.4B is still in the attacker's hands, including more than 420K ETH and 18,270 $BTC split into 1,000 BTC chunks. Nobody can freeze that bitcoin. The next stage TRM expects is bridges, swap services and OTC desks.
What I'm watching: any movement from those 19 BTC wallets, which would be a supply overhang, plus how fast Binance actually reopens withdrawals. Attribution doesn't recover funds, but it does put a clock on how fast the laundering will run.
TRM Labs attributes the $6.36B theft to TraderTraitor, the DPRK unit US authorities already tied to the Bybit hack, and says it holds that view with "high confidence." Chainalysis and on-chain sleuth ZachXBT reached the same conclusion. ZachXBT also found Binance loot commingled at one address with funds from the earlier Bitget hack after routing through THORChain, which points to a single actor behind both.
Why this matters for $BNB and the wider market: DPRK crews are patient, professional launderers. TRM counts roughly $2.7B frozen, mostly stablecoins, while about $2.4B is still in the attacker's hands, including more than 420K ETH and 18,270 $BTC split into 1,000 BTC chunks. Nobody can freeze that bitcoin. The next stage TRM expects is bridges, swap services and OTC desks.
What I'm watching: any movement from those 19 BTC wallets, which would be a supply overhang, plus how fast Binance actually reopens withdrawals. Attribution doesn't recover funds, but it does put a clock on how fast the laundering will run.